Sniffing on VPN configuration

Question

Our company wants to implement a service based on sniffing for security purposes, since we manage important information this requirement is imperative. The situation is as follows.

Everyone in the office uses a VPN for preventing external eavesdroppers to sniff in our network. Although, the company is looking forward to protect it self from the inside out, then if an employee sends a particular message containing certain key words an alarm should be sent to a particular Area. Then, is it possible to sniff on our own VPN to further increase security?

Answer 1

Although "sniffing" can be just about anything to anyone, I usually consider the term to represent low-level information discovery -- usually at layer 2 to layer 4. Your question, if I can interpret a little bit, appears to want to perform discovery at higher levels. Such sniffing is absolutely possible, but requires more work to piece together the low level protocols to build a cohesive data stream.

The class of protection you are seeking is called "Data Loss Prevention" or DLP. Such systems can be placed within the network or placed as agents on each individual machine. They will continuously scan data at rest and data in motion at high levels of abstraction.

(The fact that you have a VPN is not entirely relevant to the rest of your question, I don't believe (unless you do not control the VPN server). A VPN protects the information across an untrusted network. Perhaps this network is the public Internet, and perhaps it is a segment of an internal corporate network which processes sensitive information that needs to be separate and protected from other corporate networks. At the end of the day, the VPN traffic/data will be decrypted by the VPN server to perform actual, useful work. It is within that scope that you can embrace an in-network DLP solution -- or, you could deploy DLP agents on the individual machines -- or both.)

Answer 2

Have you looked at Data Loss Prevention (DLP) options? Symantec has a nice product.

Answer 3

What you describe is a e-mail content filter and not DLP. DLP is much wider approach, extremely expensive and because of that currently the first class buzzword of security salesmen. In contrast to that content filtering can be configured on various MTAs and you get it for free in most cases. Here is an example for Postfix.

E-mail content filtering does not depend on your network encryption, because it is done on the MTA. It works with IPsec encrypted internal networks and with L2TP encrypted external networks. But it requires that the mails are not encrypted.

If your user sends encrypted messages you have in general no chance to intercept the communication. This is one reason why some companies permit sending encrypted mails or encrypted attachments like encrypted ZIP files. Another reason is that it is not possible to perform virus checks on encrypted mails.

But there are solutions available to solve this problem. The first solution works with a master key, which gives the MTA a way to decrypt the encrypted e-mails. And the second is an encryption gateway, which does the encryption for the user, which means that the user does not need to encrypt and therefor is not allowed to encrypt.